CVE-2026-89768: Linux Kernel Information Disclosure Vulnerability

CVE-2026-89768 Overview

CVE-2026-89768 is a Linux kernel flaw in the virtual filesystem (VFS) layer affecting how backing_file_open() resolves user-visible paths for nested backing files. The regression was introduced by commit 6af36aeb147a ("lsm: add backing_file LSM hooks"), which reverted an earlier fix for nested overlayfs stacking. When a lower directory of one overlayfs mount is the merged directory of another overlayfs, memory-mapped files expose a disconnected internal path from /proc/<pid>/maps and perf/ftrace mmap records instead of the path the user opened.

Critical Impact
Kernel exposes internal intermediate-layer paths for nested overlayfs, fuse passthrough, and erofs ishare backing files, breaking process introspection and tracing accuracy.

Affected Products

Linux kernel versions containing commit 6af36aeb147a ("lsm: add backing_file LSM hooks")
Systems using nested overlayfs mounts (for example, containers stacked on overlay lowerdirs)
Systems using fuse passthrough or erofs ishare where the user file is itself a backing file

Discovery Timeline

2026-09-11 - CVE-2026-89768 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89768

Vulnerability Analysis

The defect resides in backing_file_open() in the Linux kernel filesystem layer. The function derives the path stored in the new backing file from user_file->f_path. This assumption breaks when user_file is itself a backing file, which happens with nested stacking filesystems such as overlayfs mounts whose lowerdir is the merged directory of another overlayfs.

Since commit def3ae83da02 ("fs: store real path instead of fake path in backing file f_path"), the f_path of a backing file references the real path of the intermediate layer rather than the user-opened path. Commit 924577e4f6ca ("ovl: Fix nested backing file paths") originally corrected this by passing file_user_path() from ovl_open_realfile(). Commit 6af36aeb147a then changed the first argument of backing_file_open() back to the user file and reintroduced the incorrect path derivation.

Root Cause

The root cause is an information exposure and path resolution defect. backing_file_open() calls d_path() on an intermediate backing file's f_path, whose mount is a private clone that cannot be resolved to the outermost namespace. The resulting output is a disconnected path such as /foo instead of the user-visible /ovl/nested/foo.

Attack Vector

This is a local kernel correctness issue rather than a remote code execution flaw. Any local user or process that maps a file through a nested overlayfs, fuse passthrough, or erofs ishare stack observes incorrect path data in /proc/<pid>/maps and in perf and ftrace mmap event records. Security tooling that relies on /proc/<pid>/maps for image attribution, container forensics, or symbolization loses fidelity, which can mask malicious mappings inside stacked container filesystems.

See the upstream fix at Linux Kernel Commit c031146 and related backports for the full patch series.

Detection Methods for CVE-2026-89768

Indicators of Compromise

Entries in /proc/<pid>/maps referencing files at a shortened or root-relative path (for example /foo) that does not exist at that location on the host or in the container
perf or ftrace mmap records that report a file path which cannot be resolved via readlink against the process's mount namespace
Discrepancies between readlink /proc/<pid>/fd/<n> output and the map entry for the same inode

Detection Strategies

Correlate open file descriptors from /proc/<pid>/fd with mapping entries in /proc/<pid>/maps and flag mismatches on hosts running nested overlayfs
Inspect running kernel version and identify builds carrying commit 6af36aeb147a without one of the fix commits (88c927a, a35cc21, c031146, or f2381b5)
Audit container runtimes for overlayfs stacking configurations where the lowerdir of one mount is the merged directory of another

Monitoring Recommendations

Validate symbolization and image attribution outputs from perf, ftrace, and EDR telemetry against ground-truth file paths in stacked overlay environments
Track kernel package versions across the fleet to confirm applicable stable-tree backports are installed
Alert on tracing pipelines that emit unresolved or disconnected file paths for mapped executable regions

How to Mitigate CVE-2026-89768

Immediate Actions Required

Apply the upstream fix that restores file_user_path() usage inside backing_file_open() and rebuild affected kernels
Update container hosts running nested overlayfs stacks with vendor kernels that include the backport
Revalidate any host or container security telemetry that consumes /proc/<pid>/maps after patching

Patch Information

The fix is available in the following upstream commits: Linux Kernel Commit 88c927a, Linux Kernel Commit a35cc21, Linux Kernel Commit c031146, and Linux Kernel Commit f2381b5. The patch replaces user_file->f_path derivation with file_user_path(), which returns the outermost user-visible path for backing files and falls back to &user_file->f_path for regular files.

Workarounds

Avoid nested overlayfs configurations where the lowerdir of one overlay mount is the merged directory of another until the patched kernel is deployed
Disable or restrict fuse passthrough and erofs ishare in environments where user files may themselves be backing files
Where nested stacking cannot be avoided, resolve mapped file paths through /proc/<pid>/fd/<n> symlinks instead of relying on /proc/<pid>/maps output

bash

# Verify installed kernel and confirm the fix commit is present
uname -r
# Check distribution changelog for the backport commit hashes
rpm -q --changelog kernel | grep -E '88c927a|a35cc21|c031146|f2381b5'
# Or on Debian/Ubuntu
apt changelog linux-image-$(uname -r) | grep -E '88c927a|a35cc21|c031146|f2381b5'